Extracted

• • Target
    801acb78a34b6cc753fa03c51c13e3211cca8992a7f1cb2d055106eab56bf8ff.bin
  • Size 86KB
  • SHA256 801acb78a34b6cc753fa03c51c13e3211cca8992a7f1cb2d055106eab56bf8ff
  • MD5 d4fa0f35bf0d600169e336e9786ddd78
  • SHA1 9d5b199a685f550e7119463201ffa03ca950708d
  • SHA512 19dc69a9de62cd4aa4f7098b9b48cab8e7c9e4e8f5fd92b360db7b7cdf684d52dc58527f9d736a6d2f7b99a6bf154b087798dfacfe31b2d3e3a5edaf351c9794
  • SSDEEP 1536:ZHzF/JIfi9veYaL9poVFvsGf2osYL5mwEmjrBah6O5hvJt+:ZHzFxY0c9pKoYwtmjrBaUg/w
  • TLSH
    T1BB83026E7D23C9DBC76AF4B092E39330E330F2511A9D6F3A13A4CA366F644914F65A14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  thirdratasyncratdonutloaderloaderrat

  • Async RAT payload

    rat

  • Detects DonutLoader

    loader

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2